Supporting more rules for egress

main.tf

@@ -55,17 +55,28 @@ resource "aws_security_group_rule" "ingress_cidr_blocks" {
   security_group_id = join("", aws_security_group.default.*.id)
 }
 
-resource "aws_security_group_rule" "egress" {
+resource "aws_security_group_rule" "egress_cidr_blocks" {
   count             = local.enabled && var.egress_enabled ? 1 : 0
-  description       = "Allow outbound traffic"
+  description       = "Allow outbound traffic from existing CIDR blocks"
   type              = "egress"
   from_port         = 0
   to_port           = 0
   protocol          = "-1"
-  cidr_blocks       = ["0.0.0.0/0"]
+  cidr_blocks       = var.egress_allowed_cidr_blocks
   security_group_id = join("", aws_security_group.default.*.id)
 }
 
+resource "aws_security_group_rule" "egress_security_groups" {
+  count                    = local.enabled && var.egress_enabled ? length(var.security_groups) : 0
+  description              = "Allow outbound traffic from existing security groups"
+  type                     = "egress"
+  from_port                = 0
+  to_port                  = 0
+  protocol                 = "-1"
+  source_security_group_id = var.egress_security_groups[count.index]
+  security_group_id        = join("", aws_security_group.default.*.id)
+}
+
 # The name "primary" is poorly chosen. We actually mean standalone or regional.
 # The primary cluster of a global database is actually created with the "secondary" cluster resource below.
 resource "aws_rds_cluster" "primary" {

variables.tf

@@ -14,6 +14,12 @@ variable "security_groups" {
   description = "List of security groups to be allowed to connect to the DB instance"
 }
 
+variable "egress_security_groups" {
+  type        = list(string)
+  default     = []
+  description = "List of security groups to be allowed to go in outbound from the DB instance"
+}
+
 variable "vpc_id" {
   type        = string
   description = "VPC ID to create the cluster in (e.g. `vpc-a22222ee`)"
@@ -211,6 +217,12 @@ variable "allowed_cidr_blocks" {
   description = "List of CIDR blocks allowed to access the cluster"
 }
 
+variable "egress_allowed_cidr_blocks" {
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+  description = "List of CIDR blocks allowed to go in outbound from the cluster"
+}
+
 variable "publicly_accessible" {
   type        = bool
   description = "Set to true if you want your cluster to be publicly accessible (such as via QuickSight)"